Clustered visualisation for network intrusion analysis
AZ Rana, Mao Lin Huang · UTS ePRESS (University of Technology Sydney) · 2005
The attacks on computer networks and computer systems are increasingly becoming numerous and sophisticated in nature.Hence this has given a growing need for intrusion detection systems to identify these attacks.The use of these intrusion detection systems have given rise to another problem, the handling, and the presentation of large amounts of alerts generated by these systems.In this paper we introduce a layered framework for network intrusion analysis and use a clustered visualization technique to group and visualize large amounts of alerts, and other network nodes based on their similarities.This layered clustering visualization allows users to visually explore and analyze the intrusion data.The cross-navigation between layers is achieved by user's interaction.This allows users to actively display the groups and associated properties of these alerts and nodes in an efficient way.